ARA – Policy Statement on FTC Safeguards Rule

Compliance with the FTC Safeguards Rule – Policy Statement

FOR IMMEDIATE RELEASE

Dallas, TX – January 10, 2023 – The American Recovery Association (ARA) is the national organization representing the interests of the entire collateral recovery industry. The ARA provides its members with a full suite of compliance management solutions including training, site inspections, compliance training and certification. Our members are the best trained and most compliant group of professionals in the industry. Our lender clients trust and rely on our members to deliver our services safely, compliantly, and with respect for consumers.

Protection of consumer privacy and consumer data is a top regulatory priority.

For example, the FTC Safeguards Rule is a wide-sweeping set of requirements imposed upon financial institutions—as well as organizations engaged in activity that is “incidental to financial activities”—to protect personal and private consumer data. The broad definition of “incidental to financial activity” could be construed to include recovery professionals within the scope of the Safeguards Rule.

In that case, the Rule requirements could conceivably apply to personal and private information stored in automobiles. Accordingly, ARA provides this policy statement concerning the Safeguards Rule and the collateral recovery industry.

These important consumer-protection regulations concern real-world issues.

Case in point: connecting a mobile phone to a vehicle is now an everyday occurrence for most consumers.

Consumers regularly connect their mobile phone with a vehicle to access the vehicle’s communication, navigation, and infotainment system. When this connection is made, all of the consumer’s personal information, including contacts, locations, calendar items and more may be replicated or stored within the vehicle.

The Safeguards Rule applies to automotive dealerships, lenders, servicers, recovery professionals, and any other custodian of the vehicle in the chain of custody during the repossession process, ARA’s position is that the best practice for compliance with the Rule is to ensure that consumer information is eliminated entirely from the vehicle’s computer or other electronic repository or database accessible through the vehicle.

ARA specifically believes recovery professionals should engage in the following best practices:

Immediately after recovery, cut new keys to the vehicle
Once keys are cut, access the vehicle to retrieve, inventory, and securely store all personal effects
Eliminate all consumer information from the vehicle’s computer or other electronic repository or database accessible through the vehicle

It is also the position of ARA that every subsequent custodian of the vehicle along the chain of custody should, as a matter of best practice, verify that all consumer information has been eliminated from the vehicle and take responsibility for removing any remaining consumer information before the vehicle moves to the next custodian.

ARA members should work together with their lender and servicer clients to establish compliance protocols and ensure all custodians participate in consumer-protection processes.

ARA expects that many lenders and servicers that issue recovery assignments share ARA’s concern about these important consumer-protection and regulatory issues, and will support the best-practices points above in working together with ARA members to implement them. That said, there may be lenders or servicers that do not share ARA’s position.

In any event, ARA strongly urges members to consider the following issues when working with lender and servicer clients when it comes to the FTC Safeguards Rule, as well as any other statute, regulation, or law that governs the protection of consumer data and privacy:

Do you understand the lender or servicer’s internal processes for protecting consumer data and property during their respective stages of the repossession process, including, but not limited to, eliminating consumer data from vehicle computers and other electronic repositories and databases accessible through the vehicle?
Have you obtained written assurance that the lender or servicer has such internal processes and that those processes will be applied to assignments you will be working? Does your service agreement delineate responsibility for protection of consumer data and privacy between the parties based on their custody of the vehicle?
Does your service agreement contain any representations or warranties about the lender or servicer compliance protocols for protecting consumer privacy or consumer data while the vehicle is in their custody?
Are there opt-out, waiver, indemnification, or hold harmless provisions in your service agreement? Do they speak to the issue of protecting consumer privacy and consumer data and whose responsibility that is at the various stages of the repossession process based on the chain of custody?

The long-and-short is this: ARA members conduct themselves with consumer interests in mind. That includes these critical privacy and data protection issues, which are implicated by the FTC’s Safeguards Rule. To the extent the Rule applies to recovery professionals, the industry must stay vigilant to ensure compliance.

THIS POLICY STATEMENT IS NOT LEGAL ADVICE, NOR A SUBSTITUTE FOR LEGAL ADVICE. ARA CANNOT GIVE YOU LEGAL ADVICE. YOU MUST WORK WITH YOUR INTERNAL OR OUTSIDE COUNSEL TO DETERMINE THE APPROPRIATE COURSE OF ACTION WITH RESPECT TO THE ISSUES DISCUSSED IN THIS POLICY STATEMENT.